For convenience and security I find password rotation requirements harmful. Our SOC 2 auditor seems to still require them. Does SOC 2 actually require password rotation in 2020? I would think(hope) meeting NIST password guidelines and TOTP MFA should be more than enough.
Add a comment
|
SOC 2 Type 2 does not have specific technical requirements. What you have to do is to satisfy your assessor.
And if your company cannot satisfy your assessor, then there is a mechanism called "management response" where the company gets to explain away the findings from the assessor.
And if your assessor is 4 years behind in their understanding of best practices in this area, then perhaps you need to find a new assessor ...
answered Apr 14 '20 at 7:57
-
15Password Rotation is one of the worst ideas that people still think is legitimately useful. I can't even count how often I have seen
<month><year>as password. Or<password><number>which keeps incrementing by one every few months.– MechMK1Apr 14 '20 at 12:42 -
3@MechMK1 if the password is automatically generated and submitted, it's actually a great idea. I mean, products exist that change passwords for accounts just after the password is used. It has its place, but just not with people.– schroeder ♦Apr 14 '20 at 15:08
-
8@MechMK1 at my first job we required rotation. My password was Password1, Password2, Password3..., Password9, Password1. Then I realized that you could change your password as frequently as you liked, so every 60 days I ran a Python script that changed my password 9 times. Apr 14 '20 at 15:54
-
4our proxy (squid) also used basic authentication over http, so I treated my password as public knowledge. Apr 14 '20 at 15:55
-
2@MechMK1 But <password><number> is a wonderful way to keep track of how long you have been at the company!– JiKApr 15 '20 at 9:30